Author: mark

  • WordPress Security: Please delete old themes and plugins

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    I was contacted by another site owner who was hacked via vulnerable WordPress themes today. He had updated to the latest non-vulnerable version of his theme, but the WordPress theme installation or update process doesn’t remove, or remind you to remove, old themes that may be vulnerable. So while they encourage you to update everything, old versions are still lurking on your site waiting for an attacker to take advantage of them.

    Remember: Delete all old unused themes and plugins.

    In this case an attacker once again used an old version of timthumb to install an attack shell called Sniper_SA. The attack shell was Arabic so I’m assuming the attack came from an Arabic country. [The last 3 I’ve seen were english]. This one was base64 encoded inside a PHP eval.

    The web host is one of the top 3 WordPress.org hosts on the web. Their default installation is to have your entire WordPress installation writeable by the web server and the server can even write to your home directory under the web root. This opens up all sorts of possibilities for a hacker to gain a remote shell. WordPress hosts, please secure your default WordPress installations so that only directories under wp-content/ are writeable. Also make sure the user’s home directory is not writeable by the web server by default.

     

  • DeployMint: A Staging and Deployment system for WordPress

    Exec Summary: Today I’m launching a Beta open source project called DeployMint. I’m using it on WordPress installations where WordPress is being used as a CMS. It runs as a WordPress plugin and allows for staging and deployment of WordPress sites along with robust version control and zero down-time during deployments. It uses the Git version control system to store site snapshots in a safe and space efficient way. It also takes a “belt and braces” approach and provides an emergency back-out system separate to Git in case a deployment fails. You can download the latest version of DeployMint and see a video demo at the DeployMint project page on Google Code.

    Full blog entry:

    My company is busy moving to using WordPress as a CMS and I wanted a way to instantly deploy several new pages of content or an entire site and have dev and staging sites to test new ideas. I also wanted version control, instant deployment and an emergency back-out system.

    I also needed comments to be preserved on the live site so that if I deploy a new version, the existing comments on the live site stay where they should be and only page or post content is updated.

    So I created a WordPress plugin called DeployMint.

    DeployMint runs under WordPress MU. You create as many subdomains as you would like, for example:

    • development.example.com
    • staging.example.com
    • example.com (your live site)
    1. Then you design  your entire site with themes, pages, content on development.example.com.
    2. Once you’re done, you take a snapshot of development.example.com and deploy that snapshot to staging.example.com.
    3. Your client reviews the new site on staging.example.com and suggests changes.
    4. You make the changes on development.example.com, take a new snapshot and deploy that snapshot to staging.example.com
    5. Once your client is happy, you take a snapshot of staging.example.com and deploy it to example.com, your live site.

    Here is a video showing the basic functionality of DeployMint. DeployMint is installed on this blog and I use it to test out new themes and design changes. It works as well on a blog or when WordPress is being used as a CMS. In this video I take a snapshot of my live site (this blog) and deploy it to my staging site staging.markmaunder.com. Then I make a minor modification, I re-snapshot the staging blog and deploy that snapshot to the live site.

    DeployMint is space efficient because it uses Git to store snapshots. It also makes a full copy of your entire WordPress database including all your WordPress MU sites every time you deploy. Because these require more space, you can choose how many of these full backups you want to keep. If things go awry with your database or deployment for some reason, you have an emergency backout system that will restore your WordPress MU installation to the state it was in before your previous deployment.

    Behind the scenes, DeployMint (DM) works as follows:

    • To install DeployMint you need to create a data directory that is not under your web root, but is writable by your web server.
    • When you create a new project, a new Git repository is created.
    • When you take a snapshot, DM dumps all tables belonging to the blog you snapshotted into individual files.
    • Those files are checked into a ‘Git’ repository. DM uses git for storage because it’s space efficient and robust.
    • Every snapshot you create is a new branch in the repository and only the changes are stored.
    • When you deploy using DM, it simply checks out the branch you want to deploy and imports it into a temporary database.
    • In that temp database, we merge all existing comments on your site into the site we’re about to deploy.
    • DM also modifies any hostnames it needs to, to reflect the site we’re about to deploy to’s hostname.
    • Before deployment, DM takes a full backup of your entire WordPress MU database including all sites and stores this for emergencies in case you need to back-out your changes.
    • These backups take up more disk space than snapshots, so you can choose how many of them you want to keep and DM auto-deletes the oldest ones first.
    • Then a rename is done which takes a few hundredths of a second to replace your old database with the new database we’re deploying.
    • And you’re live with your new site!

    Please post a comment below if you have any features suggestions or comments. Thanks.

  • Two techniques to scan your WordPress installation and check if you're hacked.

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    I just helped another target of the timthumb.php vulnerability to clean their machine. The method the hacker used to hide their tracks was a little different to what I’ve seen in the past. So I wanted to mention it here and let you know how to scan for it.

    As I previously mentioned, the method I’ve seen hackers use to hide their source code is to encode it using base64 encoding and then use base64_decode and eval() in PHP to execute the code at runtime.

    You can scan for base64 decoding by getting a shell on your WordPress server and running the following in the root of the WordPress installation directory:

    grep -r base64_decode *

    Keep in mind that some files that are not hacked will show up, like the newest version of timthumb.php which includes a base64 encoded image. But this is a good starting point to get a list of files that warrant further inspection.

    The hack I saw today was different. The hacker used hexadecimal escaping to hide their tracks. They didn’t just encode hostnames and things that a security analyst would obviously search for. They also encoded individual javascript commands and strings containing HTML element names.

    You can use this perl compatible regular expression to search for hex encoded data in your javascript. Again, run this in a shell in the wordpress root installation directory:

    grep -rP “(?:\\\\x[A-F0-9]{2}){5}” *

    This will search for strings of at least 5 sequential hex encoded digits. You may get some false positives like class-simplepie.php . But again, this will give you a list of files that require closer inspection.

    The file that was infected today was wp-includes/js/l10n.js. The attacker had appended hex encoded javascript to it. You can see what a normal file looks like here.

    If you’ve been hacked, or suspect you’ve been hacked, drop me an email at mmaunder at gmail. I charge a very reasonable consulting rate and it usually takes 1 to 3 hours to fix the system and harden up permissions to prevent future attacks.

  • We are centrally planned and we are vulnerable

    John Robb writes an excellent post arguing that the concentration of wealth in the United States has resulted in a centrally planned economy. I wanted to expand on his writing.

    After World War II, there was a widely held view that Nazi Germany was the result of failed capitalism. Economists and political scientists in the UK and across much of western Europe thought that Capitalism was a bad thing and the answer was socialism.

    A now famous economist called Fredreich von Hayek argued in The Road to Serfdom, published in the early 1940’s, that Nazi Germany was actually the result of central planning. He suggested that a centrally planned government is destined to become fragile and is easily seized and taken over by those that might not play by the rules.

    Hayek was based in England, but his book was far more popular in the United States and it may be the reason we ended up with a free market economy post WWII.

    John Robb’s idea is a new and useful lens to examine our political and economic decline: Through capitalism gone wild, we may have ended up with all the trappings of socialism after all.

     

     

  • The world is now paying the US government more to store their money.

    I ran across this page on the Treasury’s website via Marc Cuban’s blog. It shows the yield on US government treasury bonds, adjusted for inflation. If the yield on a bond is 3% and inflation is 2.5%, the real yield is 0.5%.

    So in inflation adjusted terms, anyone buying 5yr treasuries today is paying the US government 1.02% per year to store their money.

    Curiously, after the downgrade, the world is paying the US government even more to store their money.

     

    Treasury real yield curve

  • Why are people in London rioting? (video interview from the BBC)

    This is the other point of view. An interview the BBC probably won’t air again.

    I don’t condone violent demonstrations and I think the the looting of small businesses is sad and immoral. But you should understand that sometimes when people hit the streets en masse and make some noise, it has a purpose. It can’t be explained away by labeling them “rioters”.

    It happened during apartheid in South African where I grew up and it brought about a peaceful transition of power in the South African government.

    Back then we used to call Nelson Mandela a terrorist. Today he is Madiba, one of the most loved humans on Earth.

    If you’ve heard the music of Linton Kwesi Johnson (LKJ), you’ll recognize Darcus Howe’s sentiments. Powerful stuff.


    Update: Here is LKJ reciting Sonny’s Lettah, live.


  • Advanced WordPress: How to get Real WordPress Commenter IP Addresses behind your Nginx Proxy

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    If you run a reasonably high traffic blog on a small Linode server like this one, it’s a really good idea to set up an Nginx front-end proxy for your Apache server. It lets you handle relatively high traffic without running out of apache children while keeping keep-alive enabled.

    You can read more about how to set up Nginx and other tips on my Basic WordPress Speedup page.

    If you have set up Nginx, you’ll notice that your comments no longer have the real IP address of visitors to your site. They’re all 127.0.0.1 or something similar.

    The way I solved this was to edit my php.ini file. On my Ubuntu server this lives in /etc/php5/apache2/php.ini

    I modifed the auto_prepend_file variable to look like this:

    auto_prepend_file = /etc/php5/apache2/mdm.php

    Then in the mdm.php file I put this:


    <?php
    $mdm_headers = apache_request_headers();
    $_SERVER['REMOTE_ADDR'] = $mdm_headers["X-Forwarded-For"];
    ?>

     

    This assumes you have the following line in your Nginx.conf to forward the real IP address:

    proxy_set_header X-Forwarded-For $remote_addr;

     

  • Further update on TimThumb from Matt

    I just noticed Matt put a post up this morning giving a further update re TimThumb. You can read it here.

  • Now hold still honey while I rub this radioactive dirt on your face…

  • Watch the last 2 hours of trading live if you can

    I have a sinking feeling there will be blood. Right now Dow is down 4.45%, S&P down 5.69%, Nasdaq down 5.7%, Gold up 3.87% and rising. The DAX closed down 5% and the worst drops happend towards end of trading, so I’m expecting the same for US markets.

    Update: I hate to say I told you so. Ugh!